diff --git a/docs/swarm/ca.md b/docs/swarm/ca.md
index 311e8eb0..e6ec62ad 100644
--- a/docs/swarm/ca.md
+++ b/docs/swarm/ca.md
@@ -169,11 +169,12 @@ others.
 
 No host holds a CA or its key, except the store's mTLS CA
 (`glue-bao-tls.nix`), which signs only the store's server certificate and the
-certificates that log in to it. At boot and on every deploy, every host
-deletes `/var/lib/swarm-ca` and the `ca.pem`, `ca-previous.pem`,
-`ca-key.pem`, `ca.srl` and `.swarm-ca-adopted` in
-`<deploy.hive-controller.tls.stateDir>`. The swarm distributes only
-certificates.
+certificates that log in to it. Every host deletes `/var/lib/swarm-ca` and
+the `ca.pem`, `ca-previous.pem`, `ca-key.pem`, `ca.srl` and
+`.swarm-ca-adopted` in
+`<deploy.hive-controller.tls.stateDir>`: `systemd-tmpfiles` removes them at
+boot, and on a deploy that changes the host's `tmpfiles.d` rules. The swarm
+distributes only certificates.
 
 ⚠️ **The deletion is irreversible.** Rolling back to a generation that still
 has `swarm-ca.service` finds no root under `/var/lib/swarm-ca` and mints a